CVE-2022-4361
published 2023-07-07CVE-2022-4361: Keycloak, an open-source identity and access management solution, has a cross-site scripting (XSS) vulnerability in the SAML or OIDC providers. The…
PriorityP424medium6.1CVSS 3.1
AVNACLPRNUIRSCCLILAN
EPSS
0.69%
52.6th percentile
Keycloak, an open-source identity and access management solution, has a cross-site scripting (XSS) vulnerability in the SAML or OIDC providers. The vulnerability can allow an attacker to execute malicious scripts by setting the AssertionConsumerServiceURL value or the redirect_uri.
Affected
9 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| chrome_chrome | — | — | |
| redhat | keycloak | < 21.1.2 | 21.1.2 |
| redhat | openshift_container_platform | — | — |
| redhat | openshift_container_platform | — | — |
| redhat | openshift_container_platform_for_ibm_linuxone | — | — |
| redhat | openshift_container_platform_for_ibm_linuxone | — | — |
| redhat | openshift_container_platform_for_power | — | — |
| redhat | openshift_container_platform_for_power | — | — |
| redhat | single_sign-on | >= 7.6 < 7.6.4 | 7.6.4 |
CVSS provenance
nvdv3.16.1MEDIUMCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
vendor_redhat10.0CRITICAL
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
Chrome
Stable Channel Update for ChromeOS / ChromeOS Flex: CVE-2023-4361
vendor_chrome·2023-08-25·CVSS 5.3
CVE-2023-4361 [MEDIUM] Stable Channel Update for ChromeOS / ChromeOS Flex: CVE-2023-4361
Stable Channel Update for ChromeOS / ChromeOS Flex
CVE-2023-4361: Inappropriate implementation in Autofill. Reported by Thomas Orlita on 2023-07-17 [$1000][ 1316379 ] Medium CVE-2023-4362: Heap buffer overflow in Mojom IDL
Reported by Zhao Hai of NanJing Cyberpeace TianYu Lab on 2022-04-14 [$1000][ 1367085 ] Medium CVE-2023-4363: Inappropriate implementation in WebShare
Severity: medium
Red Hat
RHSSO: XSS due to lax URI scheme validation
vendor_redhat·2023-06-27·CVSS 10.0
CVE-2022-4361 [CRITICAL] CWE-79 RHSSO: XSS due to lax URI scheme validation
RHSSO: XSS due to lax URI scheme validation
Keycloak, an open-source identity and access management solution, has a cross-site scripting (XSS) vulnerability in the SAML or OIDC providers. The vulnerability can allow an attacker to execute malicious scripts by setting the AssertionConsumerServiceURL value or the redirect_uri.
Keycloak, an open-source identity and access management solution, has a cross-site scripting (XSS) vulnerability in the SAML or OIDC providers. The vulnerability can allow an attacker to execute malicious scripts by setting the AssertionConsumerServiceURL value or the redirect_uri.
OSV
Keycloak vulnerable to cross-site scripting when validating URI-schemes on SAML and OIDC
osv·2023-06-30
CVE-2022-4361 [CRITICAL] Keycloak vulnerable to cross-site scripting when validating URI-schemes on SAML and OIDC
Keycloak vulnerable to cross-site scripting when validating URI-schemes on SAML and OIDC
AssertionConsumerServiceURL is a Java implementation for SAML Service Providers (org.keycloak.protocol.saml). Affected versions of this package are vulnerable to Cross-site Scripting (XSS).
AssertionConsumerServiceURL allows XSS when sending a crafted SAML XML request.
GHSA
Keycloak vulnerable to cross-site scripting when validating URI-schemes on SAML and OIDC
ghsa·2023-06-30
CVE-2022-4361 [CRITICAL] CWE-79 Keycloak vulnerable to cross-site scripting when validating URI-schemes on SAML and OIDC
Keycloak vulnerable to cross-site scripting when validating URI-schemes on SAML and OIDC
AssertionConsumerServiceURL is a Java implementation for SAML Service Providers (org.keycloak.protocol.saml). Affected versions of this package are vulnerable to Cross-site Scripting (XSS).
AssertionConsumerServiceURL allows XSS when sending a crafted SAML XML request.
No detection rules found.
No public exploits indexed.
Bugzilla
CVE-2022-49352 kernel: ext4: fix warning in ext4_handle_inode_extension
bugzilla·2025-02-26·CVSS 5.5
CVE-2022-49352 [MEDIUM] CVE-2022-49352 kernel: ext4: fix warning in ext4_handle_inode_extension
CVE-2022-49352 kernel: ext4: fix warning in ext4_handle_inode_extension
In the Linux kernel, the following vulnerability has been resolved:
ext4: fix warning in ext4_handle_inode_extension
We got issue as follows:
EXT4-fs error (device loop0) in ext4_reserve_inode_write:5741: Out of memory
EXT4-fs error (device loop0): ext4_setattr:5462: inode #13: comm syz-executor.0: mark_inode_dirty error
EXT4-fs error (device loop0) in ext4_setattr:5519: Out of memory
EXT4-fs error (device loop0): ext4_ind_map_blocks:595: inode #13: comm syz-executor.0: Can't allocate blocks for non-extent mapped inodes with bigalloc
------------[ cut here ]------------
WARNING: CPU: 1 PID: 4361 at fs/ext4/file.c:301 ext4_file_write_iter+0x11c9/0x1220
Modules linked in:
CPU: 1 PID: 4361 Comm: syz-executor.0 Not tain
Bugzilla
CVE-2022-4361 RHSSO: XSS due to lax URI scheme validation
bugzilla·2022-12-07·CVSS 6.1
CVE-2022-4361 [MEDIUM] CVE-2022-4361 RHSSO: XSS due to lax URI scheme validation
CVE-2022-4361 RHSSO: XSS due to lax URI scheme validation
This issue has been addressed in the following products:
Red Hat Single Sign-On 7.6 for RHEL 9
Via RHSA-2023:3885 https://access.redhat.com/errata/RHSA-2023:3885
Discussion:
This issue has been addressed in the following products:
Red Hat Single Sign-On 7.6 for RHEL 8
Via RHSA-2023:3884 https://access.redhat.com/errata/RHSA-2023:3884
---
This issue has been addressed in the following products:
Red Hat Single Sign-On 7.6 for RHEL 7
Via RHSA-2023:3883 https://access.redhat.com/errata/RHSA-2023:3883
---
This issue has been addressed in the following products:
RHEL-8 based Middleware Containers
Via RHSA-2023:3888 https://access.redhat.com/errata/RHSA-2023:3888
---
This issue has been addressed in the following products:
2023-07-07
Published